Exmon tool followup – some questions answered

As it was mentioned in the previous post on the subject, Exmon (Exchange User Monitor) tool can be very useful when trying to analyze the impact and ways that Exchange MAPI clients are using the server (Exchange 2000 or 2003).

We had several questions that we wanted to address:

1. Where is the tool documentation?

Exmon installation is actually just unpacking of the Exmon tool and supporting files into the folder on the hard drive. The documentation is included with the tool, and can be found at the following path:

C:\program files\Exmon\Using_Exmon.doc

2. I am trying to run the tool, but it is giving me error: "Unknown StarTrace error (183)".

If Exmon tracing is interrupted in some way and the Exmon tool crashes as a result, you will not be able to start a new trace until the old trace is fully terminated.

Now, even if Exmon has terminated, it is possible that the tracing still continues. You will be able to see this by trace files still increasing in size. Tracing might continue up to the point where tracing files reach the size of 512 MB, after which tracing will be stopped and you will be able to start a new trace.

The cause of Exmon crash is being investigated at this time and we'll post updates on it!

3. I don't want to wait until traces reach 512 MB; I want to stop this tracing now.

You can use the tracelog.exe tool (in the Windows Resource Kit) to stop the Exmon trace by running a command from Command Prompt.

If you used Exmon.exe to start the trace, you can stop the trace by typing:

tracelog -stop "Exchange Event Trace"

If you have followed the Exmon documentation, and have started the trace from Command Line using the exact syntax mentioned in the documentation, you can stop the trace by typing:

tracelog -stop "Exchange Trace"

When you run it though, it's important to make sure the Exmon.exe process is not running. Note that you can stop tracing from the Command Line no matter how you started it, as long as you use the correct syntax as per above!

4. I have an Exchange 2000 Cluster server. We were running Exmon on the active node. Then, there was a failover (unrelated to Exmon) which moved the Exchange Virtual Server to a different node. The problem is - after checking the trace files on the original node, we can not do anything with them as they are used by another process. What gives?

The problem is - tracing is now "hung" as the Exchange virtual server has moved off to another node. Because there is no data to collect, the tracing files will not grow to 512 MB size at which point they would be released. Additionally, on Exchange 2000 clusters, the Information Store service stays running after the virtual server moves to a different node. This is not the case on Exchange 2003 clusters though.

There are two ways of stopping the tracing in this scenario:

- stopping the IS service, or- stopping the trace using the Tracelog tool, as explained above

5. Can you better explain the how CPU time is reported?

Exmon reports CPU for all MAPI calls made into store. As a result, some CPU time is not captured, such as DAV, POP, IMAP, OLEDB. When Exmon is running, the % of CPU captured is displayed in the lower right hand corner. Usually this number is about 75%. To calculate how much CPU a user is using multiply the CPU% of the store.exe process, the Captured CPU% from the lower right hand corner, and the User's CPU. So if store was using 60% CPU, captured is 75% and a user is using 10%, then the use is using a total of .6*.75*.10 = 4.5% of the total System CPU.

I met you at TechEd, where we spoke about forcing replication of Public Folders. You mentioned using PFDavAdmin to modify a security setting which would cause all folders to be rechecked for replication. Can you remind me what I’m supposed to do again?